CVE Intelligence

Jishenghua vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Jishenghua products: 37 record(s), with severity, exploitation and fixes.

Jsherp 37

Exploited only (KEV) →

CVE-2026-1588 Low · 2.7 CWE-22 Jan 29, 2026
jishenghua jshERP installByPath install path traversal
A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-1549 Medium · 4.3 CWE-22 Jan 28, 2026
jishenghua jshERP PluginController uploadPluginConfigFile path traversal
A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-1546 Critical · 9.8 CWE-89 Jan 28, 2026
Jishenghua jshERP SQL Injection via Excel Item Import (CVE-2026-1546)
A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-67344 Medium · 4.6 CWE-79 Dec 12, 2025
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the ...
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
CVE-2025-67341 Medium · 4.6 CWE-79 Dec 12, 2025
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability...
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
CVE-2025-51746 Critical · 9.8 CWE-502 Nov 25, 2025
Deserialization of Untrusted Data in Jishenghua Jsherp
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51745 Critical · 9.8 CWE-502 Nov 25, 2025
Deserialization of Untrusted Data in Jishenghua Jsherp
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51744 Critical · 9.8 CWE-502 Nov 25, 2025
Deserialization of Untrusted Data in Jishenghua Jsherp
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51743 Critical · 9.8 CWE-502 Nov 25, 2025
Deserialization of Untrusted Data in Jishenghua Jsherp
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks.
CVE-2025-51742 Critical · 9.8 CWE-502 Nov 25, 2025
Deserialization of Untrusted Data in Jishenghua Jsherp
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
CVE-2025-60800 High · 7.5 CWE-284 Oct 28, 2025
Improper Access Control in Jishenghua Jsherp
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request.
CVE-2025-60801 High · 8.2 CWE-77 Oct 24, 2025
Command Injection in Jishenghua Jsherp
jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.